PT0-002 Engagement Management Practice Test 4 — 15 Questions

Question 1

A penetration tester is about to start an engagement. Which document outlines the IP ranges that are in scope, the testing window, and the emergency stop criteria?

Accepted Answer

Rules of Engagement (RoE). The rules of engagement (RoE) specify technical and procedural boundaries for the test.

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Answer

Get-out-of-jail letter

Question 2

During an external penetration test, the tester discovers that a critical web application is hosted on a third-party cloud provider. The SOW did not mention this provider. What should the tester do before proceeding with testing against that provider's infrastructure?

Accepted Answer

Obtain written authorization from the third-party provider. Testing third-party services requires explicit permission from the provider to avoid legal and contractual issues.

Answer

Scan only the IP addresses that resolve to the client's domain

Answer

Continue testing as long as the target is in scope

Answer

Ignore the web application and test only on-premises assets

Question 3

A penetration tester is planning a web application test. The client wants to minimize risk to production data. Which environment should the tester recommend for testing?

Accepted Answer

Staging environment with anonymized data. Testing in a staging environment reduces the risk of impacting live data and systems.

Answer

Development environment with live data

Answer

Production environment with a read-only database

Answer

Production environment with full access

Question 4

Which legal framework in the United States makes it a crime to access a computer system without authorization, and is a key consideration when obtaining permission for penetration testing?

Accepted Answer

CFAA. The Computer Fraud and Abuse Act (CFAA) is the primary US law against unauthorized access.

Answer

SOX

Answer

HIPAA

Answer

GDPR

Question 5

Which of the following best describes the purpose of a vulnerability disclosure policy in the context of a penetration test?

Accepted Answer

To establish a process for reporting discovered vulnerabilities to the client and possibly to the public. A vulnerability disclosure policy outlines how vulnerabilities found during testing will be reported and remediated.

Answer

To list the assets that are out of scope

Answer

To define the rules of engagement for the test

Answer

To provide legal protection to the tester

Question 6

Which penetration testing standard provides a methodology that includes pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) is the only standard among the options that explicitly defines a full penetration testing methodology with the phases listed: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. PTES provides a structured, seven-phase framework designed specifically for penetration testers, making it the correct choice for this question.

Answer

OSSTMM

Answer

NIST SP 800-115

Answer

OWASP Testing Guide

Question 7

A penetration tester is scoping a test for a client that uses a SaaS application for customer relationship management. The client wants the tester to assess the application's security. What is the most important consideration regarding this SaaS application?

Accepted Answer

The tester should obtain explicit permission from the SaaS provider before testing. The tester must ensure that the SaaS provider's terms of service allow security testing and that permission is obtained.

Answer

The application is hosted on the cloud, so it is automatically in scope

Answer

The tester should only test the client's configuration of the SaaS application

Answer

The tester can test the application as long as the client provides administrative credentials

Question 8

Which of the following is typically included in the final deliverables of a penetration test?

Accepted Answer

Executive summary, technical findings, and remediation guidance. Standard deliverables include an executive summary, technical findings, and remediation guidance.

Answer

A list of all employee passwords

Answer

Network diagrams of the client's internal network

Answer

A copy of all data extracted during the test

Question 9

After completing a penetration test, the tester must handle test artifacts appropriately. Which TWO of the following are best practices for data handling and destruction?

Accepted Answer

Securely delete all test data after the engagement is complete. Best practices include securely erasing test data and returning any client data to the client.

Answer

Keep all test data indefinitely for future reference

Answer

Store test data in an unencrypted archive on the tester's laptop

Answer

Share test data with other clients for benchmarking

Question 10

A penetration tester is hired to perform a test with no prior knowledge of the target environment. The tester is given only the company name and must gather all necessary information from public sources. Which type of penetration test is this?

Accepted Answer

Black box. In a black box test, the tester has no prior knowledge or credentials, simulating an external attacker.

Answer

Grey box

Answer

Red team

Answer

White box

Question 11

During the pre-engagement phase, which document defines the IP ranges, test windows, and emergency stop criteria for a penetration test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) document specifies technical constraints like IP ranges, timing, and stop conditions.

Answer

Get-out-of-jail letter

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Question 12

The penetration tester identifies that a web application is hosted on a server that also contains sensitive customer data unrelated to the test. The SOW clearly states that only the web application is in scope. The tester accidentally accesses the customer data. What should the tester do immediately?

Accepted Answer

Report the incident to the client and stop testing. When a penetration tester accesses data outside the scope defined in the SOW, the immediate action is to stop testing and report the incident to the client. This preserves the integrity of the engagement, allows the client to assess any regulatory or contractual implications, and prevents further unauthorized access. Continuing or deleting data would compound the scope violation.

Answer

Delete the data and continue as planned

Answer

Continue testing and ignore the data

Answer

Analyze the data to find vulnerabilities

Question 13

A penetration testing engagement requires testing a production environment during business hours. The client is concerned about potential service disruption. Which document should specify the conditions under which the test must be halted?

Accepted Answer

Rules of Engagement. The Rules of Engagement (RoE) is the definitive document that outlines the scope, authorization, and constraints of a penetration test, including explicit conditions under which testing must be halted to prevent service disruption. Unlike other documents, the RoE is a legally binding agreement that specifies technical boundaries such as IP ranges, testing windows, and stop conditions (e.g., CPU threshold exceeded or application error rate spike). This ensures the client's production environment is protected during business hours.

Answer

Get-out-of-jail letter

Answer

Communication plan

Answer

Statement of Work

Question 14

During a social engineering engagement, a tester is authorized to target employees via email phishing. However, the tester accidentally sends a phishing email to a contractor who is not listed in the personnel scope. The contractor reports the email to the client's security team, causing an internal investigation. Which of the following best describes the tester's mistake?

Accepted Answer

Failure to follow the Rules of Engagement. Personnel scope must be clearly defined; the tester failed to adhere to the scoping requirements for social engineering.

Answer

Breach of the Non-Disclosure Agreement

Answer

Mishandling of discovered criminal activity

Answer

Violation of the Computer Fraud and Abuse Act (CFAA)

Question 15

A penetration tester is conducting a red team exercise. The goal is to simulate an advanced persistent threat (APT) and test the organization's detection and response capabilities. Which of the following engagement types best describes this scenario?

Accepted Answer

Red team exercise. A red team exercise (Option B) is the correct engagement type because it simulates an advanced persistent threat (APT) by emulating real-world adversarial tactics, techniques, and procedures (TTPs) across multiple attack vectors, with the primary objective of testing the organization's detection and response capabilities. Unlike a standard penetration test, a red team exercise is goal-oriented (e.g., gaining access to a specific system or data) and often operates under a covert or no-notice scenario, requiring the team to bypass security controls and evade detection over an extended period.

Answer

Wireless penetration test

Answer

Network penetration test

Answer

Web application penetration test